jose: reject an empty x5cInsecure chain instead of indexing past it

[arpitjain099]

decodeCerts returns an empty slice and a nil error when handed an empty list, so a token whose x5cInsecure header is [] yields a zero-length chain. ParseX5cInsecure then reaches for the leaf:

chain, err := GetX5cInsecureHeader(jwt)
if err != nil { ... }
leaf := chain[0]

which gives panic: runtime error: index out of range [0] with length 0. The header comes off a token supplied by the client, so the shape of that list is not something the caller chose.

The check goes in GetX5cInsecureHeader rather than at the index. It is exported, and a caller that asks for an x5cInsecure chain wants a leaf, so an empty chain is not a useful result for any of them.

Verification: a new test in jose signs a token whose x5cInsecure header is an empty list and parses it. It panics on main, and now returns ssh check-host token x5cInsecure header is empty. go test ./... passes, 39 packages.